Data Processing and Data Protection Notice

Home >Data Processing and Data Protection Notice

ProfiTrans-Mitter Ltd.

I Data Processing and Data Protection Notice

1.1. Purpose of Notice

ProfiTrans-Mitter Ltd. handles the personal data of the data subjects confidentially and in accordance with the applicable legal provisions, ensures their security, takes the technical and organisational measures and establishes the procedural rules necessary to enforce the relevant legal provisions and other recommendations.

1.2. Scope of the Notice

1.2.1. The scope of this Notice covers the processing of orders placed by ProfiTrans-Mitter Ltd. on the website managed by the data controller, the processing of orders placed on the Moveandparcel.eu official Facebook page, the processing of orders placed by e-mail or SMS, the processing of other transport contracts on behalf of the client, as well as the processing of enquiries (request for quotation, contact – via website, e-mail, Facebook, telephone), job applications and marketing.

1.2.2. The scope of this Notice extends to all persons who are involved in data management or data processing operations carried out by ProfiTrans-Mitter Ltd. or who otherwise have access to data managed or processed by ProfiTrans-Mitter Ltd.

1.2.3. The Notice shall enter into force on 1 April 2020.

1.3. Particulars of the data controller

Company name: ProfiTrans-Mitter Árufuvarozó és Szolgáltató Kft.

Headquarters, location: Hungary, 2119 Pécel, Industrial Park, Határ street 3.

Company registration number: 13-09-191390

Tax number: 22913656-2-13

Community tax number: HU 22913656

1.4. Customer service

ProfiTrans-Mitter Kft.: www.profitransmitter.hu

Phone number: +36-70-361-5497, +36-70-361-5690

E-mail: profitrans.mitter@gmail.com , kisszsolt@profitransmitter.hu ,

Move and Parcel business website: www.moveandparcel.eu

Phone number: +36-70-361-5690

E-mail: office@moveandparcel.eu , moveandparcel@gmail.com

Apply for a job:

Phone number: +36-70-361-5497

E-mail: palyazat.profi@gmail.com

1.5. Websites managed by ProfiTrans-Mitter Ltd.:

www.moveandparcel.eu

www.profitransmitter.hu

Websites redirected to www.moveandparcel.eu:

www.moveandparcel.com , www.moveandparcel.hu

II Definitions

Info Act: Act CXII of 2011 on Informational Self-Determination and Freedom of Information.
GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
Data: Data classified as personal data or special data by the Info Act and the GDPR, in particular any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as name, number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
Data subject: any natural person who is identified or can be identified, directly or indirectly, on the basis of personal data;
Data Discloser: a natural or legal person, or a company without legal personality, or a natural person acting on their behalf, who communicates personal data of third parties to ProfiTrans-Mitter Ltd. in any form, with or without a request.
Confidential information: any facts, information, other data and any compilation thereof, not readily accessible, the acquisition, use, disclosure with others or public disclosure of which by unauthorised persons would prejudice or jeopardise the legitimate financial or political interests or privacy rights of either Party.
DM Act: Act CXIX of 1995 on the Processing of Name and Address Data for the Purposes of Research and Direct Marketing.
Direct marketing: all informative activities and additional services carried out by means of direct marketing and aimed at the sale, supply or promotion of products or services directly linked to the sale of goods or services, transmitting advertising to consumers or commercial partners (hereinafter collectively referred to as: customers) in accordance with the provisions of item d of section 3 of Act XLVIII of 2008 on the basic conditions and certain restrictions on commercial advertising (hereinafter: CA Act).
Blocked list: the register of the names and addresses of data subjects who have refused, or have not consented, despite a prior request of the direct marketing organisation, to the use of their personal data for the purposes of the contact list or the marketing list specified in this policy, or have prohibited their further processing for such purposes.
CA Act: Act XLVIII of 2008 on the basic requirements and certain restrictions of commercial advertising activities
Commercial advertising: any communication, information or method of appearance which aims at facilitating the sale or other use of a marketable tangible property including money and securities as well as natural resources that can be utilized in the same way as things (hereinafter referred to as product), a service, real property or property right (hereinafter referred to as goods); it shall also include any communication, information or method of appearance, which in connection with the above aim promotes the name, the brand or the activities of an undertaking, or increases awareness over goods or trademarks (hereinafter referred to as advertising),
Data processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Contact list: a list for contacting customers for the sole purpose of obtaining consent to receive mailings for direct marketing purposes, containing at most the customer’s name, address, e-mail address or electronic communication identifier, gender, and information about the customer’s interests.
Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;

15 Filing system: a set of personal data, structured in any way, whether centralised, decentralised or structured according to functional or geographical criteria, which is accessible on the basis of specific criteria;

Data processor: a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the data controller;
Recipient: a natural or legal person, public authority, agency or any other body to whom or with which personal data is disclosed, whether or not a third party. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
Consent of the data subject: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;
Enterprise: any natural or legal person carrying out an economic activity, regardless of its legal form, including partnerships and associations carrying out a regular economic activity;
Move and Parcel: brand name operated by ProfiTrans-Mitter Ltd., ordering transport services through the website www.moveandparcel.eu or by e-mail or SMS, on the basis of which the Customer is obliged to pay a fee. Possibility of requesting quotations, contacting, applying for jobs, and publishing online blog posts and articles for Customers via the website.

III Principles relating to the processing of personal data

ProfiTrans-Mitter Ltd. respects the right of data subjects to the protection of their personal data and ensures during the data processing that each individual is in control of his or her personal data.

ProfiTrans-Mitter Ltd. processes personal data for specified lawful purposes.

ProfiTrans-Mitter Ltd. processes personal data on the basis of the legal basis specified in the legislation.

ProfiTrans-Mitter Ltd. processes personal data in a lawful and transparent manner.

ProfiTrans-Mitter Ltd. processes the amount and type of data necessary to achieve the purpose of data processing.

In all cases, the processing is based on adequate prior information provision. The information is provided in a simple, transparent and comprehensible manner.

ProfiTrans-Mitter Ltd. will ensure the security of the data and will take the technical and organisational measures and establish the procedural rules necessary to enforce the data protection rules.

It shall make the provisions of this data processing notice known and accepted by all its employees and agents acting on its behalf.

The collection and processing of data shall be carried out in compliance with the principles of fairness and lawfulness.

The duration of data processing on the basis of a voluntary provision may extend until the purpose is achieved.

During data processing only such personal data may be processed which are essential and suitable, and only to the extent necessary, for the implementation of the objective of the data processing.

The nature of the data provision, whether voluntary or mandatory, must be disclosed prior to the collection of the data.

In addition to the purpose of the processing, clear information should be disclosed as to who the data will be handled and processed by, including the case when the group of recipients is specified.

The data must be stored proportionate to the purpose of the processing in a secure manner and for a period of time adequate for the purposes of data processing.

The data shall be protected, in particular, against unlawful access, alteration, disclosure or erasure, damage and destruction.

The data subject may request information and check the content of his/her data at any time during the data processing, may request their rectification at any time, in cases provided for by law, or their erasure or restriction in the event of withdrawal of voluntary consent, and may object to the processing in cases provided for by law.

The data subject may modify or withdraw his or her consent to the processing at any time, provided that the processing is based on consent.

Processing is usually carried out electronically, by automated means.

At the same time as the purpose of the processing is fulfilled, the deletion of the data must be carried out in accordance with the legal requirements.

Data may be transferred if permitted by law and if the conditions for processing are fulfilled for each personal data subject to the transfer.

IV Certain data processing

4.1. Legal basis of data processing

ProfiTrans-Mitter Ltd. may process given data if at least one of the following legal bases applies:

4.1.1 The data subject has given his or her consent to the processing of his or her personal data for one or more specific purposes (voluntary consent)

4.1.2. 4.1.2 The processing is necessary for the performance of a contract to which the data subject is a party or for taking steps at the request of the data subject prior to entering into the contract (contract – performance of a delivery).

4.1.3. The processing is necessary for compliance with a legal obligation to which the controller is subject (compliance with a legal obligation).

4.1.4. 4.1.4 The processing is necessary to pursue the legitimate interests of ProfiTrans-Mitter Ltd. or a third party unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject (legitimate interest).

ProfiTrans-Mitter Ltd. carries out data processing for the following purposes within the scope of its activities.

4.2. Provision of services

4.2.1. Fulfilling online orders

Purpose of data processing: Fulfillment of contracts with registered or guest users via the websites www.moveandparcel.eu and www.profitransmitter.hu, fulfillment of contracts with services ordered via Facebook, e-mail or SMS; provision of information about services, other information provision, invoicing, collection of fees, settlement, analysis of overall customer habits, provision of more targeted services.

Legal basis of data processing: Item b of Paragraph 1 of Section 6 of the GDPR – performance of a contract or voluntary

Scope of data processed: full name, delivery address, telephone number, e-mail address, billing name and address, bank account number in case of bank payment.

Data transfer and data processor: for transport purposes: ProfiTrans-Mitter Ltd., subcontractors

Duration of processing: 5 years from the conclusion of the contract (limitation period) + 60 days. In the case of established contracts, 8 years + 60 days from the date of invoice pursuant to Paragraph 2 of Section 169 of the Accounting Act.

In case of a failed delivery, the data will be deleted from our online system within 5 working days; in case of an order placed by e-mail or SMS or Facebook, the coordination will be archived within 5 working days.

4.2.2. Data processing by customer service

Purpose of data processing: Purpose of processing: distinguishing customers/buyers, handling possible customer feedback, handling complaints, handling cancellations of contracts, modifying orders, customer service, financial records, contact management.

Legal basis of data processing: Item c of Paragraph 1 of Section 6 of the GDPR – Fulfillment of legal obligations, Section 17/A of the Consumer Protection Act (hereinafter: CPA)

Scope of data processed: full name, delivery address, telephone number, e-mail address, billing name and address, bank account number in case of bank payment.

Duration of processing: as regards the copies of the minutes of the complaint and the replies to written complaints, 5 years + 60 days based on Paragraph 7 of Section 17/A of the CPA.

Data transfer and data processor: ProfiTrans-Mitter Ltd. does not use a data processor for this data processing.

4.2.3 Data processing of Job applications

Purpose of data processing: keeping in contact

Legal basis of data processing: Item c of Paragraph 1 of Section 6 of the GDPR – Fulfillment of legal obligations, Section 17/A of the Consumer Protection Act (hereinafter: CPA)

Scope of data processed: full name, telephone number, e-mail address; data on CV

Duration of data processing: if ProfiTrans-Mitter Ltd. does not hire the applicant or the applicant rejects the offer, the acquired data, such as the CV and cover letter sent, will be deleted within 3 months. If the candidate is hired, the period of data processing will become indefinite.

Data transfer and data processor: ProfiTrans-Mitter Ltd. does not use a data processor for this data processing, and does not transfer the data that it has lawfully obtained.

In recruitment and hiring, the name of the company will be indicated in all cases, the job advertisement will not be managed anonymously.

4.3. Data processing for direct marketing purposes

4.3.1. Direct marketing enquiries

Purpose of processing: building a database for business purposes, maintaining contact, contacting to renew or extend processing, contacting to obtain consent for a purpose other than a previous purpose, contacting to obtain consent for a request other than a previous request, providing information about services, providing information about new services, forwarding offers of the controller, inviting to participate in promotions,

Legal basis of data processing: Item a of Paragraph 1 of Section 6 of the GDPR – voluntary consent.

Scope of data processed: full name, address, telephone number, e-mail address.

Data transfer and data processor: ProfiTrans-Mitter Ltd. does not use a data processor for this data processing.

Duration of processing: until the withdrawal of the data subject’s consent + 60 days, up to a maximum of 5 years.

4.3.2. Sending newsletters

Purpose of data processing: e-mails sent to data subjects for commercial purposes, including commercial advertising.

Legal basis of data processing: Item a of Paragraph 1 of Section 6 of the GDPR – voluntary consent

Scope of the processed data: e-mail address

Data transfer and data processor: ProfiTrans-Mitter Ltd. does not use a data processor for this data processing.

Hosting provider: WordPress internal administration system

Duration of the data processing: until the withdrawal of the data subject’s consent (unsubscription).

V Provisions on data management

5.1 Information to the data subject

Before the processing is carried out, clear and unambiguous information must be disclosed, taking into account the legal requirements, on the method and purpose of the data collection and, if the data are provided voluntarily, on their voluntary nature.

As a general principle, ProfiTrans-Mitter Ltd. declares that in all cases where it requests personal data from data subjects based on their voluntary consent, the data subjects are free to choose whether or not to provide the requested information after reading and understanding the required information.

5.2. Consent of the data subject

If ProfiTrans-Mitter Ltd. processes the personal data of the data subject on the basis of the data subject’s consent, the processing is based on the data subject’s voluntary declaration based on appropriate information, which contains the data subject’s explicit consent to the use of the personal data provided by him or her.

The disclosure of personal data to third parties or public authorities, unless otherwise required by law, is only possible on the basis of a decision by a public authority or with the prior explicit consent of the data subject.

ProfiTrans-Mitter Ltd. does not control the personal data provided to it. The person providing the data is solely responsible for the correctness of the data provided.

The data subject must be informed separately or by reference to this policy that, if he/she provides his/her e-mail address, he/she also assumes responsibility for the fact that he/she is the only one who will receive services from the e-mail address provided. With regard to this assumption of responsibility, any liability for access from an e-mail address provided shall be borne solely by the data subject who provided the e-mail address.

5.3. Content of consent and how to give it

In case of electronic data provision, checkmarking the obvious acceptance box on the electronic interface indicates understanding and acceptance of the information.

In the absence of the personal data necessary for the conclusion and performance of the contract, the supply contract cannot be concluded.

ProfiTrans-Mitter Ltd., in order to ensure the convenience of its customers, performs part of its services through the use of subcontractors with the transport data provided by the customer, which the customer is informed of when concluding the contract.

ProfiTrans-Mitter Ltd. shall provide the partner company carrying out the transport with the goods to be transported, the name and address and the given telephone number of the consignor and consignee. In doing so, it is stipulated that the transport partner may not use this data for any other purpose than transport.

ProfiTrans-Mitter Ltd. will take all necessary steps to ensure the security of the data. Within IT infrastructure used by ProfiTrans-Mitter Ltd., the tasks related to the storage and protection of data are governed by the principles, procedures and security controls contained in the IT security policy of ProfiTrans-Mitter Ltd. Personal data may only be accessed by persons holding the relevant job titles – subject to access controls.

5.4. Information technology applications – cookies, remarketing

Technology applications, provisions on online advertising.

5.4.1 Cookie management

Affected Websites concerned: www.moveandparcel.eu , www.profitransmitter.hu

Technical data and cookie management: the system of ProfiTrans-Mitter Ltd. (or the data processor it has contracted) automatically records the IP address of the computer of the data subject, the starting time of the visit and in some cases – depending on the computer’s settings – the type of browser and operating system. The data thus recorded cannot be linked to other personal data. The data are processed for statistical purposes only.

Cookies allow a website or application to recognise previous visitors. Cookies help ProfiTrans-Mitter Ltd. to optimise a website, to tailor the services of the website or application to the habits of the data subjects. Cookies are also capable of remembering settings so that they do not have to be re-entered when the data subject visits a new page; remember previously entered data so that it does not have to be re-entered; analyse the use of the website or application to ensure that the information obtained is used to the best of the user’s expectations, so that the data subject can easily find the information they are looking for; monitor the effectiveness of advertising.

The user can set their web browser to accept all cookies, reject all cookies, or notify the user when a cookie is received.

It is possible to enable or disable cookies, but the data subject can also set the browser to ask for permission to accept cookies. If cookies are disabled, some web services will not function properly and disabling them does not mean that the computer’s presence on the internet is hidden, browsing habits can still be tracked. After disabling, HTTP requests will still include the starting location (HTTP referrer), IP address, browser version number, operating system version number and other information.

If you want to manage your cookie settings or disable the feature, you can do so from your own user computer or device in your browser. This option can be found under Cookies/cookies/Tracking feature settings depending on your browser’s toolbar, but in general you can set which tracking features you want to enable/disable on your computer under Tools/Settings /Privacy settings.

5.4.2 Remarketing

Affected websites: www.moveandparcel.eu, www.profitransmitter.hu

Cookies allow us to show ads to people who have previously visited our website, cookies also allow us to limit the number of times you see an ad, so you don’t have to see the same ad over and over again.

ProfiTrans-Mitter Ltd. uses the remarketing services of Facebook, Google Adwords & Analytics to show ads on third party websites (including Facebook, Instagram, Google) to previous visitors of the ProfiTrans-Mitter Ltd. website. This may also mean showing ads to a visitor who has not finalised their order or has just sent it. Ads can be text or image-based ads within the Google Display Network.

You can control the ads that appear on Facebook/Instagram on the Facebook/Instagram page to stop them from reappearing.

ProfiTrans-Mitter Ltd. cannot identify, cannot see where the advertisement appears to the user, it is done in an automated way. Remarketing service providers provide anonymous statistics to ProfiTrans-Mitter Ltd.

5.5. Storage of personal data

5.5.1. Data storage principles

ProfiTrans-Mitter Ltd. shall ensure that the method and content of the records comply with the legislation in force. ProfiTrans-Mitter Ltd. shall ensure that data processing for different purposes is logically separated. ProfiTrans-Mitter Ltd. shall manage electronic records on the basis of uniform principles, taking into account the characteristics resulting from the differences in the data carriers of the records. The principles and obligations set out in this Notice apply to electronic records.

The records are structured in order to distinguish between data processing operations that can be separated on the basis of their legal basis and purpose.

ProfiTrans-Mitter Ltd. shall ensure, by means of the structure of the record keeping system, the definition of the rights and other organisational measures, that the data contained in the personnel register may only be accessed by those employees and persons acting in the interests of ProfiTrans-Mitter Ltd. who need to know it in order to perform their job or task.

ProfiTrans-Mitter Ltd. operates the electronic register by means of an IT program that meets the requirements of data security. The program ensures that the data are only accessed for the purpose for which they are intended, under controlled conditions and only by those persons who need to have access to them in order to perform their tasks. The accesses and activities of persons having access to the data shall be recorded.

If the authorised authorities request ProfiTrans-Mitter Ltd. to provide personal data in the manner prescribed by law (e.g. on suspicion of a criminal offence, in an official data seizure order), it shall provide the requested and available information in compliance with its legal obligation.

5.5.2. Electronic data storage

The data provided to ProfiTrans-Mitter Ltd. electronically is collected and in some cases stored on ProfiTrans-Mitter Ltd.’s own servers.

5.6. Duration of data storage

ProfiTrans-Mitter Ltd. determines the duration of data storage in accordance with the legal basis and purpose of data processing.

If the period of data storage is determined by law, ProfiTrans-Mitter Ltd. shall store the data for the period prescribed by law.

If the purpose of the data processing has ceased, the data must be deleted.

When the data subject has prohibited the processing, subject to exceptions provided for by law, the data shall be erased.

If any data is to be deleted, ProfiTrans-Mitter Ltd. will separate the data from the original register and transfer it to the register of data marked for deletion. Only employees of ProfiTrans-Mitter Ltd. who are authorised to carry out their duties and who are absolutely necessary for the electronic deletion of the data have access to the register of data designated for deletion.

In case of deletion of data, ProfiTrans-Mitter Ltd. deletes all personal data or anonymizes them in such a way that the original personal data can no longer be recovered.

ProfiTrans-Mitter Ltd. will in any case carry out and document the deletion of data requested by the data subject, provided that the request can be lawfully fulfilled. ProfiTrans-Mitter Ltd. shall place the data subject’s data in the necessary records for the purpose of verifying the lawful processing of data up to the time of the request for erasure or in order to avoid future processing. ProfiTrans-Mitter Ltd. shall ensure that the deletion of data is carried out in a verified and verifiable manner.

5.7. Data processing

ProfiTrans-Mitter Ltd. may in certain cases transfer data to third parties, such as

5.7.1. to subcontractors involved in the performance of the contract

5.7.2. in order to comply with a judicial, official request or other lawful request for data.

The processor and any person acting under the control of the controller or the processor who has access to the personal data may process the data only in accordance with the instructions of ProfiTrans-Mitter Ltd., unless they are obliged to do otherwise by EU or Member State law.

ProfiTrans-Mitter Ltd. has several data processors for its activities. The contact details of the data processor and the individual data processing activities, the categories of data affected by the data processing are set out in Section 5.8 of this Notice.

If ProfiTrans-Mitter Ltd. transfers the data subject’s data to data processors, it shall inform the data subject prior to the start of data processing.

5.8. Data processors

ProfiTrans-Mitter Ltd. has concluded a contract with the data processors listed below for the processing of data. Data processing includes all activities with the data that ProfiTrans-Mitter Ltd. performs with the data, but has entrusted third parties to perform them, who act on behalf of ProfiTrans-Mitter Ltd.

The personal data processed in the systems of External Service Providers is governed by the Third Party Service Providers’ own privacy notices. The Data Controllers shall use their best efforts to ensure that the External Service Provider processes the personal data transferred to it in accordance with the law and uses it only for the purposes specified by the user or as set out in this Notice. After April 1, 2020, the External Service Providers shall record, handle and process the personal data transmitted to them by the Data Controllers and processed by them in accordance with the provisions of the GDPR.

5.8.1 Transport services: use of different subcontractors in certain cases

Activity: transport services

Category of data processed: name of consignor and consignee, delivery address, phone number

5.8.2 Hosting service provider for www.moveandparcel.eu

Name: Tarhely.Eu szolgáltató Kft.

Address: 1538 Budapest, Pf.:510.

Activity: website hosting services

Managed data category: name, address, service, phone number, e-mail address

5.8.3 Accounting office

5.8.4 Website developer: in case of www.moveandparcel.eu and www.profitransmitter.hu websites, an employee of ProfiTrans-Mitter Ltd.

VI Rights of the data subjects

6.1. Data subject’s right of access

The data subject shall have the right to obtain from ProfiTrans-Mitter Ltd. confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:

a) the purposes of data processing;
b) the categories of the personal data concerned;
c) the recipients or categories of recipients to whom or which your personal data were disclosed or will be disclosed, including in particular third country recipients or international organizations;

(d) where applicable, the planned period of storage of the personal data or, if this is not possible, the criteria for determining that period;

(e) the right of the data subject to obtain from the controller the rectification, erasure or restriction of the processing of personal data concerning him or her and to object to the processing of such personal data;

(f) the right to lodge a complaint with a supervisory authority;

g) if the data was not collected from the data subject, all available information regarding their source;

(h) the fact of automated decision-making, including profiling, as referred to in Paragraphs (1) and (4) of Article 22 of the GDPR and, at least in those cases, the logic used and clear information on the significance of such processing and its likely consequences for the data subject.

If personal data are transferred to a third country or an international organisation, the data subject shall be entitled to be informed of the appropriate safeguards regarding the transfer.

6.2. Correction and deletion

The data subject shall have the right to have inaccurate personal data concerning him or her corrected by ProfiTrans-Mitter Ltd. without undue delay upon request. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

ProfiTrans-Mitter Ltd. will correct the data within 5 working days from the receipt of the request, in view of its activities and internal procedures.

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

a) the personal data is no longer necessary in relation to the purposes for which they were collected or otherwise processed;
b) the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing (a request for cancellation of registration on the website can be sent to Customer Service by e-mail; the possibility of unsubscribing from the newsletter can be found at the bottom of the newsletter or sent to Customer Service by e-mail)
c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing or the data subject objects to the processing for direct marketing purposes;
d) the personal data have been unlawfully processed;

e)1 the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Data Controller is subject;

In the case of processing for the fulfilment of a legal obligation, the GDPR does not even allow the data subject to exercise the right to erasure if the processing is necessary for the fulfilment of a legal obligation based on the processing.

In the event of a failed order, ProfiTrans-Mitter Ltd. will not store the data and will delete them.

6.3. Right to restriction of processing

The data subject shall have the right to obtain from ProfiTrans-Mitter Ltd. restriction of processing where one of the following applies:

a) the data subject contests the accuracy of the personal data, in which case the restriction shall apply for the period of time that allows ProfiTrans-Mitter Ltd. to verify the accuracy of the personal data;
b) the processing is unlawful and the data subject opposes the erasure of the data and requests instead the restriction of their use;
c) the controller no longer needs the personal data for the purposes of the processing, but the data subject requires them for the establishment, exercise or defence of legal claims; or
d) the data subject has objected to the processing; in this case, the restriction shall apply for the period until it is established whether the legitimate grounds of the controller override those of the data subject.

Where processing is restricted on the basis of the foregoing, such personal data may be processed, except for storage, only with the consent of the data subject or for the establishment, exercise or defence of legal claims or the protection of the rights of another natural or legal person or for important public interests of the European Union or of a Member State.

The controller shall inform the data subject at whose request the processing has been restricted in advance of the lifting of the restriction.

6.4. Data portability

The Data Subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, if:

a) the processing is based on voluntary consent or on consent given by the data subject to the processing of the special data or based on a contract; and
b) the processing is carried out by automated means.

In exercising the right to data portability as set out above, the data subject shall have the right to request, where technically feasible, the direct transfer of personal data between the data controllers.

The exercise of the foregoing right shall not prejudice the right to erasure.

6.5. Right to receive information

Therefore, the Data Subject has the right to object – on grounds relating to his/her particular situation – at any time to the processing of his/her personal data. In this case, ProfiTrans-Mitter Ltd. may no longer process the personal data, unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If the data subject objects to the processing of personal data for direct marketing purposes, the personal data may no longer be processed for these purposes.

The right referred to above must be explicitly brought to the attention of the data subject at the latest at the time of the first contact with the data subject and the information must be clearly displayed separately from any other information.

In the context of the use of information society services and by way of derogation from Directive 2002/58/EC, the data subject may exercise the right to object by automated means based on technical specifications as well.

6.6. Notification obligation

ProfiTrans-Mitter Ltd. shall inform all recipients of any rectification, erasure or restriction of processing to whom or with which the personal data have been disclosed, unless this proves impossible or involves a disproportionate effort. The controller shall inform the data subject, at his or her request, of those recipients.

6.7. Legal remedies

6.7.1. Direct legal remedies of ProfiTrans-Mitter Ltd.

The data subject has the possibility to send his/her comments, complaints, objections directly to ProfiTrans-Mitter Ltd. in connection with the data processing of ProfiTrans-Mitter Ltd. at the contact details indicated in this Notice and to as for the remedy requested by him/her.

The data subject may contact the Customer Service of ProfiTrans-Mitter Ltd. with questions, complaints, notifications related to data processing and the rights related to data processing. The Customer Service shall ensure that the questions, complaints and notifications are forwarded to the appropriate department, that the data subject receives a response within the deadline and that the necessary measures are taken.

6.7.2. National Authority for Data Protection and Freedom of Information

The data subject may turn to the National Authority for Data Protection and Freedom of Information (hereinafter: the Authority) if he or she believes that he or she has suffered or is at imminent risk of suffering a legal harm in connection with the processing of his or her personal data, unless judicial proceedings are pending in the matter in question. The Authority will investigate or initiate official proceedings on the basis of a notification.

Contact details of the National Authority for Data Protection and Freedom of Information:

postal address: 1530 Budapest, Pf. 5. , address: 1125 Budapest, Szilágyi Erzsébet fasor 22/C.

+36-1-391-1400 , fax: +36 -1-391-1410 , ugyfelszolgalat@naih.hu , www.naih.hu

6.7.3. Judicial remedies

The data subject may bring an action for the protection of his or her personal data before the competent court of the place where the controller is established or the place of residence of the data subject.

6.7.4. Data Protection Officer

With regard to the relevant provisions of the GDPR, ProfiTrans-Mitter Ltd. is not obliged to appoint a data protection officer as ProfiTrans-Mitter Ltd. is not a public authority or a body with public responsibilities, and the activities of ProfiTrans-Mitter Ltd. do not involve operations that require systematic and systematic large-scale monitoring of the data subject, and ProfiTrans-Mitter Ltd. does not process sensitive data or personal data relating to decisions to establish criminal liability and criminal offences.

Data Security

To meet the requirement of data security, data processing operations must be designed and implemented in a way which ensures the protection of the privacy of data subjects. ProfiTrans-Mitter Ltd. shall ensure the security of the data, and shall take the technical and organisational measures necessary to enforce the data protection and confidentiality rules.

It protects the data by appropriate measures, in particular against unauthorized access, alteration, transmission, disclosure, deletion or destruction, unavailability due to accidental destruction and damage resulting from a change in the technology used.

When determining and implementing measures for data security, the actual development level of technology must be considered. In case there are several possible solutions for data processing, the one should be selected which offers higher protection level for the personal data, unless this would mean unreasonable costs or hardship to the data controller.

In scope of its tasks related to IT security ProfiTrans-Mitter Ltd. shall ensure in particular:

Measures to protect against unauthorised access, including protection of software and hardware devices and physical protection (access protection, network protection);
Measures to ensure that data files can be recovered, including regular backups and separate, secure management of copies (mirroring, backup);
Protecting data files against viruses (anti virus protection);
The physical protection of data files and the media on which they are stored, including protection against fire, water, lightning and other natural hazards, and the recoverability of damage caused by such events (archiving, fire protection).

VIII Amendments to the Data Processing Notice

ProfiTrans-Mitter Ltd. reserves the right to modify this Data processing Notice at any time if it deems it justified on the basis of experience or if changes in legislation make such modifications necessary.

If the data subject does not agree with the changes, he or she may notify ProfiTrans-Mitter Ltd. in writing within 8 days of becoming aware of the changes. In this case, ProfiTrans-Mitter Ltd. shall be obliged to delete the personal data of the data subject unless the deletion of the data is not permitted by a legal obligation.

If the data subject does not object to the modification within the aforementioned time limit after becoming aware of it, the new Data Processing and Data Protection Notice shall enter into force in respect of the data subject’s personal data.

Pécel, 1 April 2020.